This topic was last discussed a bit more than a year ago . However, in light of recent QC research advances, experts have expressed concerns that Q-day might come much earlier than expected: 2025-12-21: Shtetl-Optimized » Blog Archive » More on whether useful quantum computing is “imminent” 2026-03…

It seems I can't edit my post anymore, so here is a small correction: It seems the last brief discussion of the topic was actually in February this year: Post-Quantum-Crypto Roadmap . (My apologies for missing this!) However, the assumption there was still that cryptographically-relevant quantum com…

[image] Post-Quantum-Crypto Roadmap Client dev T…

I had originally planned a different post here, arguing about how rushing things can make you end off worse than you were before, but I took the time to read Filippo's article carefully - thanks for linking it, definitely recommended to anyone - and I retract my original argument. Not arguing agains…

Wow, thanks for pinging me with this. In other venues in 2025, some people called me “silly” and accused me of being “Chicken Little” for my advocacy of immediate upgrades to hybrid post-quantum encryption. Now, I feel like an ostrich that just got its head pulled out of the sand about digital sig…

From a client point of view we just need to know what key types to support, which will take care of getting a cert which is theoretically usable. The CAs will determine that. The OS/server will need to take care of the actual TLS cipher suite negotiation as normal, and that may or may not work depe…

Yes, we are definitely working on PQC. You can refer to my previous post that was linked, and I expect we’ll have a blog post up sometime this year with a more concrete plan going forward.

Also note that while Filippo's blog post calls out "large ML-DSA signatures shoved in places designed for small ECDSA signatures, like X.509", it specifically does so for PKIs other than the WebPKI. For the WebPKI, he emphasizes that he thinks Merkle Tree Certificates remain the best path forward, a…

What will happen at acme account side? Will they use standard mldsa? If we trust ca enough one could use symmetric hmac key as account key, but It'd likely too much load for that key as we can proxy acme.

[image] aarongable: ...both standalone (large but available quickly) and landmark-relative (small but only available asynchronously) certs from a single Finalize request. How does Let’s Encrypt see this interacting with the trend towards short-lived certs? There has never been any real advan…

Cloudflare ran some real-world experiments on the "how many bytes can we realistically accept?" a few years back. ( revised analysis here ). They found that going over 10KB would cause significant amount of handshake failures (as in, it's not slow but it doesn't work at all) due to implementation defi…

Roadmap request (redux): Post-quantum cryptography

Feature Requests

orangepizza April 8, 2026, 5:43pm 3

Topic		Replies	Views
Roadmap Request: Post Quantum Cryptography Feature Requests	12	4304	January 24, 2025
[Let's Encrypt Blog] A Post-Quantum Future for Let's Encrypt Issuance Policy	10	640	June 5, 2026
Post-Quantum-Crypto Roadmap Client dev	2	1347	February 6, 2026
ECDSA Root and Intermediates ISRG/Organizational	28	8469	June 11, 2020
Let's Encrypt new hierarchy plans Issuance Tech	29	10597	August 13, 2020

Roadmap request (redux): Post-quantum cryptography

Related topics